Description

A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/course/btn_functions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T08:16:51.433Z",
  "pubdate": "2026-09-20T08:16:51.433Z",
  "executiveSummary": "The Online Reviewer Management System 1.0 is susceptible to a remote SQL injection vulnerability located within the /reviewer_0/admins/assessments/course/btn_functions.php file. This vulnerability arises from the improper sanitization of the 'courseID' parameter before it is incorporated into database queries.\nA remote, unauthenticated attacker can exploit this flaw to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. The vulnerability poses a significant risk to the integrity and confidentiality of the system. Successful exploitation allows an attacker to interact directly with the database, facilitating the extraction of sensitive information or bypass of application-level authentication. Given the public disclosure of the exploit, immediate remediation is required to prevent compromise.",
  "technicalDetails": "The vulnerability is classified as an SQL injection flaw residing in the processing logic of the 'courseID' parameter within the '/reviewer_0/admins/assessments/course/btn_functions.php' file. The root cause is the application's failure to adequately neutralize user-supplied input before using it in a SQL query construct. By manipulating the 'courseID' input parameter, an attacker can escape the intended SQL statement syntax and append malicious queries.\nExploitation is possible remotely and does not require elevated privileges, assuming the affected component is reachable via the web interface. An attacker can transmit a specially crafted HTTP request where the 'courseID' parameter contains malicious SQL syntax, such as UNION-based payloads or boolean-based blind injection sequences. When the server processes this request, the database engine executes the injected SQL commands with the privileges assigned to the database user account used by the application.\nThe attack flow follows a structured path: first, the attacker identifies the input vector by observing the 'courseID' parameter in the HTTP GET or POST request. Second, the attacker crafts a payload designed to manipulate the query logic. Third, the payload is submitted to the server, which passes the unsanitized input directly into the database query engine. Fourth, the injected code is executed, resulting in the desired outcome—typically unauthorized data retrieval, manipulation of existing records, or denial-of-service via query disruption.\nBecause the application does not utilize parameterized queries or prepared statements, it remains fully vulnerable to any attacker capable of reaching the file over the network. The impact of such an attack is critical, as it can lead to full database compromise, including the exfiltration of administrative credentials, user records, and sensitive assessment content. The lack of input validation at the application layer serves as the primary technical failure, allowing the backend to process attacker-controlled data as trusted code instructions."
}